Last Updated: March 11, 2025

Carla.ca, through itself or its affiliated entities (collectively, "Carla", "we", "our", "us"), is a Canadian automotive technology company providing a finance-focused marketplace, software products, and services to automotive dealerships and other business entities. Our platform facilitates consumer financing applications, dealership marketing strategies, and various tools aimed at accelerating vehicle sales.

When web visitors, prospective customers, and authorized system users ("you", "your") use and interact with our websites (including without limitation www.carla.ca) (collectively, our "Sites"), communicate with us, visit our offices, attend our events, or otherwise engage with our Services, we may collect, use, share, and process information that relates to you, including identifying information ("Personal Data"). This Privacy Policy summarizes our Personal Data processing practices and your related rights.

1. Responsibility Towards Your Personal Data

Unless specified otherwise herein, we act as a data controller regarding Personal Data we collect and process for our own business purposes. This applies to:

• Information collected from prospective and actual business customers who engage with us ("Customers");

• Visitors to our Sites;

• Individuals who interact with us directly through our offices, events, and communications

• Authorized users of our platforms and systems (e.g., employees of our Customers granted access to our platform).

This Privacy Policy does not apply to Personal Data we process in the role of a processor or service provider on behalf of a Customer, including:

• Customers integrating our platforms with their own websites and applications;

• Customers using our marketplace to facilitate vehicle financing;

• Customers conducting electronic communications with third parties;

• Customers collecting, using, sharing, or processing Personal Data via our Services.

For Personal Data collected by a Customer using our Services ("Customer Data"), the Customer is the data controller. We do not determine the purpose or means of processing this data. If you have questions regarding Customer Data, please contact the Customer that collected your information directly.

2. Processing Activities Covered

This Privacy Policy applies to Personal Data collected by us when:

• You visit our Sites that display or link to this Privacy Policy;

• You visit our social media pages;

• You visit our offices;

• You communicate with us via email, phone, video calls, text messages, or faxes;

• You use our products and Services for system access, security monitoring, service analytics, and fraud prevention;

• You register for, attend, or participate in our events, webinars, or contests;

• You work for a service provider, vendor, consultant, or supplier ("Vendors");

• You are employed by a Customer and your information has been shared with us;

• You participate in surveys, reviews, or research facilitated by us;

• We conduct internal business operations including product improvement, training, and legal compliance.

3. Linked Third-Party Websites

Our Sites and Services may contain links to third-party websites, applications, and platforms that are not owned or controlled by us. Additionally, our Services may integrate with third-party applications. When you interact with a third party, the privacy practices of that third party apply. We strongly recommend reviewing their privacy policies to understand their data collection and processing activities.

4. Personal Data We Collect

4.1 Personal Data Collected Directly From You

The types of Personal Data we collect depend on how you interact with us and our Services. This may include:

• Contact Information: Name, job title, company name, address, phone number, email address, date of birth;

• Financial & Billing Information: Payment details, transaction history;

• Communication Data: Emails, chat interactions, support inquiries;

• Device & Usage Data: IP address, browser type, interactions with our Sites, and other related data.

4.2 Personal Data Provided by Customers

We process Customer Data for business transactions, including:

• Identity verification;

• Soft-pull and hard-pull credit snapshots;

• Inventory and marketplace matching;

• Finance application submissions;

• Trade-in valuation.

• SMS and email interactions

5. Personal Data of Others

If you provide us with Personal Data about other individuals, you represent that you have obtained their permission. If you believe your Personal Data has been shared improperly, please contact us.

6. Personal Data We Collect From Other Sources

We may collect publicly available information or receive Personal Data from third-party providers, such as business contact databases, advertising networks, or financial institutions.

7. Personal Data We Collect Through Automatic Means

We may collect usage data and track interactions using cookies, web beacons, and similar technologies to improve user experience, enhance security, and analyze trends. You can manage your cookie preferences through your browser settings.

8. How We Use Your Personal Data

We process Personal Data for purposes including:

• Providing and improving our Sites and Services;

• Security monitoring and fraud prevention;

• Regulatory compliance;

• Internal reporting and business planning;

• Marketing and promotional communications;

• Customer relationship management.

9. Who We Share Personal Data With

We may share your Personal Data with:

• Vendors and service providers for IT, analytics, and marketing support;

• Event sponsors (where applicable);

• Third-party advertisers and networks;

• Public authorities where legally required;

• Professional advisors such as legal or financial consultants.

10. Children's Data

Our Sites and Services are not directed at children under 13. We do not knowingly collect Personal Data from minors. If you believe we have done so, please contact us to request deletion of such data.

11. Data Retention

We retain Personal Data as long as necessary for business purposes or legal compliance. Upon expiration of the applicable retention period, we securely delete or anonymize data.

12. How We Secure Your Personal Data

We implement industry-standard security measures to protect Personal Data from unauthorized access, disclosure, or loss. However, no system is entirely secure, and we encourage users to safeguard their credentials.

13. Your Rights Relating to Your Personal Data

Depending on your jurisdiction, you may have rights to:

• Access, correct, or delete your Personal Data;

• Object to processing or request data portability;

• Withdraw consent where applicable;

• Opt out of marketing communications.

14. Exercising Your Rights

To exercise your rights, please contact us using the details provided in Section 17. We may require identity verification to process certain requests.

15. International Data Transfers

Your Personal Data may be transferred outside of your jurisdiction, including to Canada and the U.S. We ensure adequate protection measures for cross-border data transfers.